# Authentication
Source: https://nordvec.com/docs/guides/authentication#rotating-and-revoking

## Rotating and revoking [#rotating-and-revoking]

<Callout type="warn">
Treat an API key like a password. If one leaks, rotate or revoke it immediately.
</Callout>

- **Rotate** replaces a key's credential in place. The previous credential keeps
  working for a grace window you choose: none, 15 minutes, 1 hour, 6 hours or
  24 hours (the default), so you can roll the new credential out to your
  services without downtime.
- **Revoke** disables a key immediately; it can no longer authenticate.

Both actions require a signed-in session (they are not themselves API-key
operations), so a leaked key cannot be used to rotate itself.